This is not directly related to the usual topics here, but I'm having strange checksum issues runnin...

# compose

[vide]

This is not directly related to the usual topics here, but I'm having strange checksum issues running unit tests in compose compiler 🧵

[vide]

When trying to run anything inside studio, I get

Dependency verification failed for configuration 'classpath':
  - On artifact stax-api-1.0-2.pom (javax.xml.stream:stax-api:1.0-2) multiple problems reported:
      - in repository 'Gradle Central Plugin Repository': artifact is not signed
      - in repository 'Gradle Central Plugin Repository': expected a 'sha256' checksum of '2864f19da84fd52763d75a197a71779b2decbccaac3eb4e4760ffc884c5af4a2' but was '47f02f02090fe4760c88c4570277f33586ea11500a014b35fc7855a2f0973e6d'
This can indicate that a dependency has been compromised. Please carefully verify the checksums.

[vide]

It looks like the stax-api-1.0-2.pom file is downloaded from the gradle plugin repository instead of maven, which looks like the one that the metadata verification expects... I don't get the error when running tests from the command line with ./gradlew .

[vide]

I'm launching studio with ./studiow compose

[shikasd]

You want to make sure to run it in offline mode and use prebuilts downloaded with the repository

[vide]

Is there a doc that details the setup process? I've followed https://github.com/androidx/androidx/blob/androidx-main/docs/onboarding.md but it doesn't mention an offline mode

[shikasd]

Ah, you use GitHub setup, that makes sense then, I'll report this issue
We almost exclusively use aosp Gerrit repo for development which has a bit different setup with prebuilts and sdk included

[shikasd]

It actually looks like the doc above describes the same setup as we use, weird that you get verification issues

[vide]

I actually switched to using the full setup

[vide]

I just linked the GH version as it was easier to find. It applies to setting up the full repo

[shikasd]

I'd try repo sync, it might be something temporary

[shikasd]

I think ./studiow should be in offline mode by default and it should never download dependencies, so something is definitely wrong

[vide]

Huh, that's very strange then. It's definitely downloading a lot of stuff from remote sources.

[vide]

I'll try repo sync again to see if there's any changes

[shikasd]

Which project do you open in AS? Is it the default one (frameworks/support) or something else?

[vide]

./studiow compose filters to show compose-related subprojects by default, but I think it just opens the support project. I haven't opened them manually

[vide]

I can run the tests after manually overwriting the checksum for that one specific library in verification-metadata but by your description it sounds like my development AS is somehow extremely broken because as far as I see it downloads all dependencies instead of using local ones

[shikasd]

Yeah, I also assume you synced whole repo from scratch? I wonder if github setup somehow interfered there

[vide]

Yeah, I did the initial sync with the full version in a fresh directory. I can try to nuke my gradle folder and all remains of the GH repo on Monday and try again 😅

[vide]

I ran repo rebase and opened AS again and it actually seems to work now!

[vide]

Not sure if it's now in an offline mode but it doesn't complain about any checksum mismatches at least.

[shikasd]

technically it shouldn't download anything even when you are in online mode (it just uses prebuilt folder as source for "downloads"), but whatever works 😉